CVE-2023-34475

Vulnerability

A heap use-after-free issue exists in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. The bug occurs when the function manipulates the XMP profile data: after a SetStringInfoLength call that may resize the profile buffer, the internal pointer datum is not refreshed, leading to a use-after-free write on the now-stale pointer. This vulnerability can be triggered by a specially crafted image file, such as a TIM2 or JPEG, which causes a conversion operation to execute the vulnerable code path. Affected versions include ImageMagick prior to the commit that adds the fix [2].

Exploitation

An attacker must trick a user into opening a specially crafted image file (e.g., TIM2 or JPEG) with ImageMagick, for example via a convert command or through an application that uses ImageMagick for image processing. No authentication is required; the attack vector is local, relying on user interaction. Once the crafted file is opened, the ReplaceXmpValue() function is invoked, and the heap use-after-free write occurs, causing the application to crash [1][2].

Impact

Successful exploitation results in an application crash (denial of service). The vulnerability is limited to causing a heap-use-after-free write, which can lead to memory corruption and termination of the process. There is no evidence in the available references of code execution or data exfiltration; the impact is confined to availability [1][2].

Mitigation

The issue is fixed in ImageMagick commit 1061db7f80fdc9ef572ac60b55f408f7bab6e1b0, which refreshes the datum pointer after resizing the profile buffer [2]. Users should update to a version that includes this commit or later. Red Hat has acknowledged the CVE and likely released updated packages [1]. Fedora package announcements contain update advisories [3][4]. No workaround is provided in the references. If patching is not possible, users can avoid opening untrusted image files with ImageMagick.